STIGQter: STIG Summary: Windows 10 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 04 May 2021:

Data Execution Prevention (DEP) must be configured to at least OptOut.

DISA Rule

SV-220726r569187_rule

Vulnerability Number

V-220726

Group Title

SRG-OS-000433-GPOS-00192

Rule Version

WN10-00-000145

Severity

CAT I

CCI(s)

• CCI-002824 - The information system implements organization-defined security safeguards to protect its memory from unauthorized code execution.

Weight

10

Fix Recommendation

Configure DEP to at least OptOut.

Note: Suspend BitLocker before making changes to the DEP configuration.

Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
Enter "BCDEDIT /set {current} nx OptOut". (If using PowerShell "{current}" must be enclosed in quotes.)
"AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.

Opted out exceptions can be configured in the "System Properties".

Open "System" in Control Panel.
Select "Advanced system settings".
Click "Settings" in the "Performance" section.
Select the "Data Execution Prevention" tab.
Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:".

Check Contents

Verify the DEP configuration.
Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
If the value for "nx" is not "OptOut", this is a finding.
(The more restrictive configuration of "AlwaysOn" would not be a finding.)

Vulnerability Number

V-220726

Documentable

False

Rule Version

WN10-00-000145

Severity Override Guidance

Verify the DEP configuration.
Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.)
If the value for "nx" is not "OptOut", this is a finding.
(The more restrictive configuration of "AlwaysOn" would not be a finding.)

Check Content Reference

M

Target Key

4072

Comments