Disabling Windows Security Features

This is a guide for ^

About Windows Security Features

Windows includes several security features like Exploit Protection and Control Flow Guard that help protect against malware and exploits. However, these features can sometimes interfere with certain applications, requiring them to be disabled.

Disabling Exploit Protection

Method 1: Through Windows Security

1. Open Windows Security:

   • Press Windows + I to open Settings

   • Navigate to Privacy & Security > Windows Security

   • Click Open Windows Security

2. Access Exploit Protection:

   • Click App & Browser control

   • Select Exploit protection settings

Exploit protection settings

1. Modify Program Settings:

   • Click Program settings tab

   • Click Add program to customize

   • Choose Add by program name

   • Enter your program's executable name

   • Disable all protections for the program

Method 2: Using PowerShell (System-Wide)

1. Open PowerShell as Administrator

2. Export Current Settings:

   Get-ProcessMitigation -System > settings.xml

3. Disable Exploit Protection:

   Set-ProcessMitigation -System -Disable CFG,DEP,AuditSEHOP,SEHOP,StrictHandle,TerminateOnError

Method 3: Registry Editor

1. Open Registry Editor:

   regedit

2. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

3. Modify Values:

   • Create DWORD MoveImages = 0

   • Set EnableCfg = 0

Disabling Control Flow Guard (CFG)

Method 1: Visual Studio Project

If you're a developer, disable CFG in your project:

1. Open project properties

2. Navigate to C/C++ > Code Generation

3. Set Control Flow Guard to No

Method 2: System-Wide Disable

1. Registry Modification:

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 0 /f

2. Verify with PowerShell:

   Get-ProcessMitigation -System | Select CFG

Additional Security Features

Data Execution Prevention (DEP)

1. Command Line Disable:

   bcdedit.exe /set {current} nx AlwaysOff

2. Through System Properties:

   • Open System Properties

   • Advanced tab > Performance > Settings

   • Data Execution Prevention

   • Choose "Turn on DEP for essential Windows programs only"

Address Space Layout Randomization (ASLR)

1. Registry Disable:

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v MoveImages /t REG_DWORD /d 0 /f

2. PowerShell Command:

   Set-ProcessMitigation -System -Disable ASLR

SEHOP (Structured Exception Handler Overwrite Protection)

Set-ProcessMitigation -System -Disable SEHOP

Creating Exclusions for Specific Programs

1. Export Default Settings:

   Get-ProcessMitigation -System > default_settings.xml

2. Create Program-Specific Rules:

   Set-ProcessMitigation -Name "program.exe" -Disable CFG,DEP,ASLR,SEHOP

PowerShell Script for Complete Disable

# Save current settings
Get-ProcessMitigation -System > "C:\security_backup.xml"

# Disable all protections
Set-ProcessMitigation -System -Disable CFG,DEP,ASLR,SEHOP,StrictHandle
Set-ProcessMitigation -System -Reset

# Disable via registry
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v MoveImages /t REG_DWORD /d 0 /f

# Disable DEP
bcdedit.exe /set {current} nx AlwaysOff

Important Notes

1. Create a system restore point before making changes

2. Some changes require a system restart

3. Windows Updates might re-enable these features

4. Document all changes for future reference

Verifying Changes

Check CFG Status

Get-ProcessMitigation -System | Select CFG

Check DEP Status

bcdedit.exe /enum {current} | findstr nx

Check ASLR Status

Get-ProcessMitigation -System | Select ASLR

Restoring Security Features

1. Using Backup:

   Set-ProcessMitigation -PolicyFilePath "C:\security_backup.xml"

2. Reset to Windows Defaults:

   Set-ProcessMitigation -System -Reset

3. Enable through Registry:

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 1 /f
   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v MoveImages /t REG_DWORD /d 1 /f

For additional support or specific program configurations, contact our support team.