Configure Hardware-Enforced Stack Protection in Registry

This article outlines how to configure Hardware-enforced Stack Protection (Control-flow Enforcement Technology or CET) using the Windows Registry Editor. You will learn the exact registry keys responsible for managing both system-wide kernel-mode shadow stacks and per-application user-mode stack protection settings in Windows.

Kernel-Mode Hardware-Enforced Stack Protection Key

To manage system-wide Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks) in Windows 11, the primary registry key is located under the Device Guard configuration:

• Registry Path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks
• Value Name: Enabled
• Value Type: REG_DWORD
• Value Data:
  • 1 = Enabled
  • 0 = Disabled

Note: If the KernelShadowStacks key or Enabled DWORD does not exist, create it manually under the Scenarios subkey.

User-Mode and Per-Application CET Configuration Keys

For individual applications, Hardware-enforced Stack Protection operates through Windows Exploit Protection and Image File Execution Options (IFEO).

1. Per-Application Settings

To configure CET for a specific executable (e.g., example.exe):

• Registry Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\example.exe
• Value Name: MitigationOptions
• Value Type: REG_QWORD / REG_BINARY

This binary mask defines exploit mitigation states, including User-Mode Shadow Stacks and Indirect Branch Tracking (CET).

2. System-Wide Mitigation Baseline

The default kernel-level mitigation options applied across the operating system are stored in:

• Registry Path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
• Value Name: MitigationOptions
• Value Type: REG_QWORD / REG_BINARY

Requirements for CET Enforcement

For these registry settings to take effect, the system must satisfy the following hardware and software criteria:

1. Hardware Support: Intel 11th Generation Core processors (Tiger Lake) or newer, or AMD Ryzen 5000 series (Zen 3) or newer.
2. Virtualization-Based Security (VBS): VBS must be enabled in Windows for Kernel-mode Stack Protection to operate.
3. System Reboot: Any direct modifications to these registry keys require a system restart to take effect.