Windows OS: Data Execution Prevention (DEP) must be configured to at least OptOut


Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.


Configure DEP to at least OptOut.
Note: Suspend BitLocker before making changes to the DEP configuration via BCDEDIT

BCEDIT Method:
- Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
- Enter "BCDEDIT /set nx OptOut".
- "AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.

System Properties Method:

  • Open "System" in Control Panel.
  • Select "Advanced system settings".
  • Click "Settings" in the "Performance" section.
  • Select the "Data Execution Prevention" tab.
  • Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:".

W10 /

800-53: CM-7(2)