Enable Hardware-Enforced Stack Protection via Regedit

Hardware-enforced Stack Protection uses Control-flow Enforcement Technology (CET) to secure system memory against Return-Oriented Programming (ROP) and call/jump-oriented attacks. In the Windows Registry, system-wide policies for kernel-mode hardware-enforced stack protection are primarily managed under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks key, while broader system mitigation bitmasks are defined under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel. This article outlines the specific registry keys, values, and steps needed to configure CET system-wide.

Primary System-Wide CET Registry Key

To manage system-wide Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks), Windows utilizes the following registry path:

• Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks
• Value Name: Enabled
• Value Type: REG_DWORD
• Value Data:
  • 1 = Enabled (Enforces kernel shadow stacks across the operating system)
  • 0 = Disabled

System-Wide Mitigation Options Key

Windows also evaluates system-wide process mitigation baselines—including user-mode CET enforcement—via the Session Manager kernel configuration:

• Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel
• Value Name: MitigationOptions
• Value Type: REG_BINARY or REG_QWORD

This value contains a bitmask representing various Exploit Protection features configured at the global operating system level.

Per-Application CET Registry Management

If Hardware-enforced Stack Protection needs to be configured or exempted for individual applications rather than system-wide, Image File Execution Options (IFEO) is used:

• Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<ExecutableName.exe>
• Value Name: MitigationOptions
• Value Type: REG_QWORD or REG_BINARY

Hardware and System Prerequisites

For the registry policies to take effect, the following hardware and software requirements must be met:

1. Processor Support: Intel 11th Generation (Tiger Lake) or newer, or AMD Ryzen 5000 (Zen 3) series or newer supporting Intel CET or AMD Shadow Stack architecture.
2. Operating System: Windows 11 or Windows Server 2022 and later.
3. Virtualization-Based Security (VBS): VBS and Hypervisor-Protected Code Integrity (HVCI) must be enabled in the firmware and operating system.