Chapter 3: Fine-Tuning Windows Vista’s Appearance and Performance
Fine-Tuning Data Execution Prevention
Data Execution Prevention (DEP) is a memory protection technology. Your com-
puter uses DEP to mark all memory locations used by applications as nonexecutable
unless the location explicitly contains executable code. If an application attempts to
execute code from a memory page marked as nonexecutable, the processor can raise
an exception and prevent it from executing. This behavior is designed to thwart a
malicious program, such as a virus, from inserting itself into areas of memory. By
allowing only specific areas of memory to run executable code, DEP protects your
computer from many types of self-replicating viruses.
You can implement DEP via hardware or software. Hardware-based DEP is more
robust because you can extend it to any program or service running on the com-
puter. Software-based DEP is less robust because it typically works best when pro-
tecting Windows programs and services.
32-bit versions of Windows support DEP as implemented by Advanced Micro
Devices Inc. (AMD) processors that provide the no-execute page-protection (NX)
processor feature. Such processors support the related instructions and must be run-
ning in Physical Address Extension (PAE) mode. 64-bit versions of Windows also
support the NX processor feature.
You can determine whether your computer hardware supports DEP by completing
the following steps:
1. In the Control Panel, click the System and Maintenance category heading link.
2. Click Performance Information and Tools.
3. Under Tasks, click “Adjust visual effects.” This opens the Performance Options
4. Click the Data Execution Prevention tab. As Figure 3-23 shows, the lower por-
tion of this tab lists the DEP support available.
Once you’ve accessed the Data Execution Prevention tab, you can configure the way
DEP works using these options:
Turn on DEP for essential Windows programs and services only
Enables DEP only for the operating system services, programs, and components.
This is the default and recommended option for computers that support execu-
tion protection and are configured appropriately.
Turn on DEP for all programs except those I select
Enables DEP for the operating system, as well as all programs and services you
Because some programs won’t work with or will become unstable with software-based
DEP, you may find that you have to add exceptions when you enable DEP for all pro-
grams. Click Add to specify programs that should run without execution protection. In
this way, execution protection will work for all programs except those you have listed.