iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To enable processor-based security in Windows, keep hardware DEP enabled, verify the NX/XD setting in UEFI, and optionally turn on Memory integrity under Windows Security. The phrase is not one universal Windows switch: it usually means DEP/NX/XD, while Memory integrity is a separate VBS and HVCI protection.
The original phrase comes from older Windows guidance about processor-enforced Data Execution Prevention (DEP). On modern Windows, readers may also use it to describe virtualization-based security (VBS), Memory integrity, Secure Boot, TPM-backed protections, or hardware-enforced stack protection.
The procedures below separate those technologies so you can enable the protection you actually need without applying an outdated Windows XP or Windows Vista workaround.
Key takeaways
- Hardware DEP uses NX on AMD processors or XD on Intel processors to prevent code from executing in memory pages marked for data.
- Windows DEP policy is controlled through the boot configuration value
nx, whose supported policies areOptIn,OptOut,AlwaysOn, andAlwaysOff. - Memory integrity is a separate Windows 10, Windows 11, and Windows Server 2016-or-later VBS/HVCI feature that protects kernel-mode code integrity.
- UEFI may call the processor-side setting NX, No Execute, Execute Disable, XD, or Data Execution Prevention, and some systems hide the setting because the feature is permanently enabled.
- Older applications and drivers can fail when DEP or Memory integrity blocks behavior that is unsafe, obsolete, unsigned, or incompatible.
What does “processor-based security” mean?
“Processor-based security” is not a precise current Windows feature name. In the historical article context, the phrase means hardware-enforced DEP: the processor marks selected memory pages as non-executable, and Windows uses that capability to reduce certain memory-execution attacks. A contemporary reader may instead mean a group of hardware-assisted protections, including DEP, VBS, HVCI, Secure Boot, and hardware-enforced stack protection.
#1 Best Overall
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
The original article was published on February 27, 2007 and referred to Windows XP SP2 and Windows Vista-era hardware. Those instructions are historical, not the correct main procedure for Windows 10 or Windows 11.
| Protection | Security layer | What it does | Is it the same as DEP? |
|---|---|---|---|
| DEP/NX/XD | Process memory execution | Prevents execution from memory pages marked non-executable. | Yes, this is the protection most often meant by the original phrase. |
| VBS | Windows hypervisor | Isolates selected security functions from the normal Windows kernel. | No. |
| Memory integrity/HVCI | Kernel code integrity inside VBS | Helps prevent unauthorized or unsuitable kernel-mode code from running. | No. |
| Secure Boot | Boot chain | Helps ensure that trusted signed boot software is loaded. | No. |
| Hardware-enforced stack protection | CPU and control-flow mitigation | Helps defend against some stack-based control-flow and return-oriented attacks. | No; Microsoft documents it as requiring VBS and HVCI on supported systems. |
Enabling Memory integrity does not replace DEP, and enabling DEP does not automatically turn on VBS, HVCI, Secure Boot, or stack protection.
What are DEP, NX, XD, and EVP?
DEP is Windows’ policy for reducing unsafe code execution from memory. According to Microsoft’s DEP documentation, Windows marks certain memory pages as non-executable. If a process attempts to execute code from a protected data page, Windows can raise an access violation and terminate the affected process.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →DEP can reduce the impact of some buffer-overflow and related exploit techniques, but DEP is not antivirus software. DEP does not identify, disinfect, or remove malware, and DEP does not prevent every exploit.
| Term | Usually associated with | Meaning |
|---|---|---|
| NX | AMD and general technical terminology | No-execute page protection. |
| XD | Intel | Execute Disable technology. |
| EVP | AMD | Enhanced Virus Protection, AMD’s historical branding for the capability. |
| DEP | Windows | The operating-system policy that uses hardware and, where necessary, software execution protection. |
Applications that generate code dynamically, use executable memory incorrectly, or depend on old compatibility techniques can encounter DEP-related failures. A blocked application does not automatically mean DEP is defective; the application may need an update or a supported compatibility configuration.
How can you check whether hardware DEP is available?
Check hardware availability separately from the Windows DEP policy. A processor must support NX or XD for hardware-enforced DEP. Windows can also expose the current boot policy, which tells you whether DEP is enabled and how broadly it applies.
Method 1: Use the legacy WMIC check
Open Command Prompt and run:
wmic OS Get DataExecutionPrevention_AvailableA result of TRUE indicates that hardware-enforced DEP is available. However, wmic is a legacy Windows tool and may not be installed or enabled on newer Windows installations. Treat a missing wmic command as a limitation of the diagnostic tool, not proof that the processor lacks NX or XD.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Method 2: Inspect modern security capabilities with PowerShell
Open Windows Terminal or PowerShell and run:
Get-CimInstance -ClassName Win32_DeviceGuard `
-Namespace rootMicrosoftWindowsDeviceGuardMicrosoft documents the Win32_DeviceGuard class for checking VBS-related capabilities. Depending on the Windows installation and hardware, the returned properties can show available and required security properties, whether VBS is running, code-integrity policy status, NX protection availability, Secure Boot support, and hypervisor support.
Rank #2
- AI-Ready Performance for Local Deployment - Intel Core Ultra 7 255H processor with DDR5 RAM delivers the computational power needed to run mainstream large language models locally, enabling AI workloads without cloud dependency
- Enterprise-Grade Security Features - Integrated fingerprint reader, Firmware TPM 2.0, Kensington Security Slot, and 1080p camera with privacy shutter protect sensitive business data and ensure secure authentication for professional environments
- Expansive Display for Productivity - 16-inch WUXGA (1920x1200) screen provides ample workspace for multitasking, data analysis, coding, and content creation with clear visuals for extended work sessions
- Comprehensive Connectivity Options - Multiple I/O interfaces, including USB Type-C, USB-A, HDMI, Ethernet RJ45, audio jack, and SD card reader support diverse peripheral connections for flexible workspace configurations.This bundle includes a 500GB portable hard drive, giving you extra storage space anytime and anywhere. Just plug it in and start saving your photos, videos, music, and documents. It's compact, lightweight, and easy to carry — perfect for home, work, or travel.
- Professional Operating System - Windows 11 Pro includes advanced security features, remote desktop capabilities, BitLocker encryption, and enterprise management tools for business and professional use
The PowerShell query is particularly useful when the question has shifted from basic DEP to modern processor-assisted security. It does not provide a universal model-by-model guarantee for every firmware implementation, so also check the UEFI setting and Windows Security interface.
Method 3: Check the Windows DEP boot policy
Open an elevated Command Prompt or Windows Terminal and run:
bcdedit /enum {current}Find the nx entry. The Microsoft BCDEdit documentation defines the principal values as follows:
nx value |
Meaning | Practical interpretation |
|---|---|---|
OptIn |
DEP applies to Windows components by default. | Valid general-purpose policy with compatibility flexibility. |
OptOut |
DEP applies broadly, with administrator-configured exclusions. | Useful where controlled exclusions are required. |
AlwaysOn |
DEP applies to all processes and cannot be selectively disabled. | Stronger enforcement, but potentially less compatible with legacy software. |
AlwaysOff |
DEP is disabled. | Not recommended except as a controlled troubleshooting step. |
How do you enable DEP in current Windows?
Use an elevated terminal, select a supported nx policy, restart, and verify the result. Hardware DEP is normally already active on supported modern Windows systems, so inspect the current setting before changing it.
- Save your work and open Windows Terminal, Command Prompt, or PowerShell as administrator.
- Record the current boot configuration:
bcdedit /enum {current}- If the existing policy is not suitable, set a policy. For a less disruptive general setting, use:
bcdedit /set {current} nx OptInFor stronger system-wide enforcement, use:
bcdedit /set {current} nx AlwaysOn- Restart Windows.
- Run
bcdedit /enum {current}again and confirm the intendednxvalue. - If available on the system, use the WMIC or PowerShell checks above to confirm hardware support.
AlwaysOn is a hardening choice, not a mandatory repair step for every computer. If a legacy application, debugger, runtime, or code-generation tool stops working, identify and update the software before considering a less restrictive policy. Do not use the following as a routine fix:
bcdedit /set {current} nx AlwaysOffAlwaysOff disables DEP and removes a useful exploit-mitigation layer. If you must use it for controlled testing, record the original policy and restore DEP immediately afterward.
How do you enable NX or XD in BIOS or UEFI?
Enable the firmware option named NX, XD, Execute Disable, or a similar label, but do not expect one universal menu path. Firmware menus vary by motherboard, laptop manufacturer, firmware version, and processor generation.
Recommended Free Tools
- Save your work and restart the computer.
- Enter UEFI or BIOS setup using the manufacturer’s documented key. Common keys include F2, Delete, F10, and Esc, but the correct key varies.
- Look in menus such as Security, Advanced, CPU Configuration, Processor Configuration, or System Security.
- Enable the setting if present. Search for any of these names:
NXNo ExecuteExecute DisableXDData Execution Prevention
- Save the firmware changes and restart.
- Verify the result in Windows with
bcdedit /enum {current}and the available hardware checks.
Some modern systems expose no NX/XD switch because the processor capability is permanently enabled, controlled automatically, or hidden by the OEM. Microsoft lists the common firmware terminology in its DEP availability guidance. A missing menu item alone does not establish that the processor lacks the feature.
Rank #3
How do you enable Memory integrity on Windows 10 and Windows 11?
Turn on Memory integrity at Windows Security → Device security → Core isolation details → Memory integrity. Memory integrity is Microsoft’s user-facing name for a VBS-based HVCI feature, so this procedure enables a different protection layer from basic DEP.
- Open Windows Security.
- Select Device security.
- Select Core isolation details.
- Turn Memory integrity on.
- Restart Windows if Windows Security requests a restart.
Microsoft documents Memory integrity for Windows 10, Windows 11, and Windows Server 2016 and later in its VBS and code-integrity guidance. Memory integrity generally requires hardware virtualization to be enabled in UEFI or BIOS. Depending on the system and policy configuration, Secure Boot and other hardware-security properties may also be required.
Which BIOS setting enables virtualization?
CPU virtualization is separate from NX/XD. To support VBS and HVCI, look for one of these firmware labels:
- Intel Virtualization Technology or VT-x on Intel systems.
- AMD-V or SVM Mode on AMD systems.
Enable the virtualization option, save the change, restart, and try Memory integrity again. Do not confuse virtualization with DEP: NX/XD provides non-executable memory protection, while CPU virtualization allows Windows to use the hypervisor features required by VBS.
Does processor generation affect Memory integrity?
Yes, processor generation can affect Memory integrity’s performance impact. Microsoft says Memory integrity works better on Intel Kaby Lake and later processors that support Mode-Based Execution Control, and on AMD Zen 2 and later processors that support Guest Mode Execute Trap. Older processors may rely more on emulation and can experience a larger performance impact.
Memory integrity can also block unsigned, old, vulnerable, or poorly written drivers. Microsoft warns that incompatibility can cause applications or devices to malfunction and, rarely, can contribute to a blue screen or boot failure. Update Windows, firmware, drivers, and applications before enabling the feature on an older or specialized system.
How do you verify DEP, VBS, and Memory integrity?
Use both the Windows Security interface and the command line because the two checks answer different questions.
Verify DEP policy
Run this command in an elevated terminal:
bcdedit /enum {current}Confirm that the nx value is the policy you selected, such as OptIn or AlwaysOn. A policy value does not by itself prove that the processor has the required hardware capability, which is why the hardware checks are useful too.
Rank #4
Verify VBS and hardware security capabilities
Run:
Get-CimInstance -ClassName Win32_DeviceGuard `
-Namespace rootMicrosoftWindowsDeviceGuardReview the returned fields for available security properties, required security properties, VBS running status, code-integrity policy status, NX protection availability, Secure Boot support, and hypervisor support. Property names and returned values can differ by Windows configuration, so use the Windows Security interface as the readable confirmation of Memory integrity.
Verify Memory integrity in the GUI
Open Windows Security → Device security → Core isolation details. The Memory integrity switch should show that the feature is on. If the switch is unavailable or Windows names an incompatible driver, resolve that driver issue before retrying.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do if DEP or Memory integrity causes a problem?
Treat DEP failures and HVCI failures as compatibility issues first, not as evidence that the protection should remain disabled. Use the branch that matches the symptom.
Free tools Windows power users keep installed
One-click scans. No signup required.
An application no longer launches after changing DEP
- Update the application, runtime, debugger, or development tool.
- Check whether the application dynamically generates code or uses executable memory incorrectly.
- Restore the recorded DEP policy if the failure blocks essential work.
- Test
OptIninstead ofAlwaysOnonly when the application requires a less restrictive policy. - Avoid leaving
AlwaysOffenabled.
Memory integrity will not turn on
- Read the incompatible-driver name shown in Windows Security.
- Look for a current driver from the hardware or software manufacturer.
- Install available Windows and firmware updates.
- Remove obsolete software or devices if no compatible driver exists.
- Restart Windows and retry Memory integrity.
Do not delete or replace a driver blindly. A driver may belong to storage, graphics, virtualization, security, or another device that Windows needs to boot.
Windows becomes unstable or cannot boot after enabling Memory integrity
If Windows still starts, turn Memory integrity off in Windows Security → Device security → Core isolation details, then restart and address the incompatible driver.
If Windows cannot start normally, use Windows Recovery Environment, open an elevated Command Prompt, and run Microsoft’s documented HVCI rollback command:
reg add "HKLMSYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /fRestart after the registry change. This disables the HVCI setting so Windows can boot while you remove or update the incompatible driver. Use the recovery command only from the correct Windows installation and keep a record of the change.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesbcdedit reports an error
Check these causes:
- The terminal was not opened with administrator privileges.
{current}is not the intended boot entry.- BitLocker or enterprise boot-management policy restricts boot-configuration changes.
- The computer is managed by an organization.
- The requested policy conflicts with an application-compatibility configuration.
Always record the original output of bcdedit /enum {current} before editing the boot configuration, and avoid undocumented boot flags.
Best Value
Should you enable processor-based security?
For most supported Windows computers, leave DEP enabled and enable Memory integrity when compatible drivers and hardware support it. DEP provides a basic memory-execution mitigation with relatively narrow scope. Memory integrity adds stronger kernel-mode code-integrity isolation, but it can block outdated drivers, affect older processors more noticeably, and create compatibility or boot problems on systems with unsupported software.
| Situation | Recommended approach | Reason |
|---|---|---|
| Modern Windows PC with no compatibility issue | Keep DEP enabled; consider Memory integrity. | Provides layered protection without disabling a core mitigation. |
| Older application fails under strict DEP | Update the application and test OptIn before considering broader changes. |
Preserves more protection than disabling DEP globally. |
| Memory integrity names an old driver | Update or remove the driver, then retry. | HVCI is designed to reject unsuitable kernel-mode code. |
| Older CPU or specialized workstation | Test performance and device compatibility. | Older processors may incur more Memory integrity overhead. |
| Windows XP SP2 or Vista | Follow version-specific historical documentation, not the Windows 10/11 UI path. | The original article’s workflow targets those older operating systems. |
Historical note: why older instructions look different
Older guides often describe Windows XP SP2 or Windows Vista menus and examples such as the AMD Athlon 64 3800+ or Intel Core 2 Extreme X6800. Those examples explain the history of NX/XD-based DEP, but they are not current processor-buying guidance and should not be treated as Windows 11 instructions.
Modern Windows uses boot configuration policies and exposes newer protections through Windows Security. The correct first step is therefore to identify whether the reader means DEP/NX/XD or modern VBS and Memory integrity, then configure and verify that specific layer.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Frequently Asked Questions
Does enabling Memory integrity enable DEP?
No. Memory integrity is a VBS and HVCI feature that protects kernel-mode code integrity, while DEP uses NX/XD to restrict execution from protected memory pages. Both protections can be enabled independently and provide different security functions.
What if my BIOS does not show an NX or XD option?
A missing NX or XD option does not necessarily mean that the processor lacks hardware DEP. Many modern systems permanently enable the capability, control it automatically, or hide the setting in firmware. Verify hardware support and the Windows DEP policy instead.
Is AlwaysOn DEP better than OptIn DEP for every user?
No. AlwaysOn applies DEP to all processes and does not allow selective disabling, while OptIn applies DEP to Windows components by default. AlwaysOn is a stronger hardening choice, but older applications and code-generation tools may require compatibility troubleshooting.
Can Memory integrity cause a blue screen?
Memory integrity can cause driver or application compatibility problems and, rarely, boot failure when an incompatible kernel-mode driver is present. Update or remove the named driver first; if Windows becomes unbootable, Microsoft documents disabling HVCI from Windows Recovery Environment with a registry command.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Bottom Line
Bottom line: “Processor-based security” usually means hardware DEP backed by AMD NX or Intel XD. Check the nx boot policy, leave DEP enabled, and use the UEFI setting only if the firmware exposes it. If you mean newer hardware-backed Windows security, separately enable Memory integrity under Windows Security → Device security → Core isolation details, after checking virtualization and driver compatibility.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
