You can easily check whether
your system supports hardwareor
software-enforced DEP by
checking the DEP configuration
settings. You can access these
settings using the Advanced Settings
option in the System Control
Panel applet and navigating to
the Advanced and Performance
Settings options.
At the bottom of the DEP configuration
settings screen, there’s a reference to the type
of DEP your system supports. Figure 2 shows
the DEP configuration settings on a Vista
system. (I’ll explain the other configuration
options later in this section) The bottom line
reads, “Your computer’s processor supports
hardware-based DEP.”
If your system supports software-enforced
DEP (meaning that your machine doesn’t
have the NX- or XD-compatible processor),
you’ll see “Your computer’s processor does
not support hardware-based
DEP. However, Windows
can use DEP software to
help prevent some types of
attacks.”
An alternative way to
check whether your system
supports hardware- or
software-enforced DEP is
by using Windows Management
Instrumentation
(WMI) commands. The
procedure is outlined in the
Microsoft article at support.microsoft.com/kb/912923.
On XP SP2, Windows
2003 SP1, and later Microsoft
OSs, DEP is enabled
by default. However, DEP
doesn’t always protect all
programs running on your
system. The exact list of programs
that are protected by DEP is defined by DEP’s protection level. DEP
supports two protection levels:
- Level 1—The first level protects only the
Windows system code and executables
and doesn’t offer DEP protection for additional
Microsoft or third-party applications
that run on your system.
- Level 2—The second level protects all
executable code that runs on your system;
it offers DEP protection for both Windows
system code and the Microsoft or thirdparty
applications that run on your system.
By default, XP SP2 and Vista run DEP at protection
level 1; Windows 2003 SP1 and Server
2008 run DEP at protection level 2.
Administrators can configure the DEP
protection levels from the DEP configuration
screen, which you can see in Figure 2. In this
example (which shows the default DEP configuration
settings on a Vista system), DEP
is enabled for essential Windows programs
and services only—DEP protection level 1.
You can use the other radio button Turn on
DEP for all programs and services except those
I select to switch to DEP protection level 2,
which is the default setting on Windows 2003
SP1 and Server 2008.
Protection level 2 lets you exempt certain
applications from DEP protection. This
ability to exempt apps is important because
some legacy applications don’t run properly
when DEP is enabled—for example, at the time of writing, Microsoft Word was still
automatically exempted from DEP. Before
switching your DEP protection to level 2, you
must run an application compatibility test
to ensure that all applications run properly
when DEP is enabled. To exempt one of
your applications from DEP, you can add the
application’s executable to the excluded list
in the DEP configuration screen using the
Add… button.
You can easily check whether a given
application is protected by DEP by checking
the DEP column of the application’s process
in the Windows Task Manager, which Figure
3, page 66, shows. If you don’t see the DEP
column on your system, you can add it using
the Task Manager’s View\Select Columns…
option.
Another way to exempt one of your
applications from DEP is to create a software
fix to distribute to your systems that automatically
disables DEP for a given application
on those systems. Microsoft refers to
such a software fix as a DisableNX shim. To
create this software fix, see the Microsoft
Application Compatibility Toolkit (ACT),
which also includes a
tool called Compatibility
Administrator
that can help (technet.microsoft.com/en-us/windowsvista/aa905078.aspx).
Application developers
can also do the
opposite—directly
enable their applications
for DEP support
in their application
binaries. To do so, they
use the /NXCompat
compilation switch.
One important final note is that when DEP
is running in protection
level 2, your system will run
a bit slower because of all
the extra DEP checks that are
carried out on the processor
and system memory level.
That’s why for test systems
that aren’t exposed to the
Internet, for example, you
can consider turning off DEP
protection completely. The
only way to turn off DEP completely
on a given system is to specify the
/NoExecute=AlwaysOff switch in the system’s
boot.ini file.
Continue on Page 3
Register
