Exploit Guard Control Flow Guard Registry Keys

This article provides an overview of the specific Windows Registry keys used to manage Control Flow Guard (CFG) settings within Windows Defender Exploit Guard. It covers the exact registry paths for system-wide configuration, per-application overrides, and enterprise policy deployments, detailing how Windows stores and enforces these exploit mitigation settings.

System-Wide Control Flow Guard Registry Key

System-wide Exploit Guard mitigation policies, including default Control Flow Guard states, are managed at the kernel level. The primary registry path for system-wide mitigation settings is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel

• Value Name: MitigationOptions
• Type: REG_BINARY or REG_QWORD
• Function: Stores bitmask values representing the enabled, disabled, or audit states for various system-wide mitigations, including CFG.

Per-Application Control Flow Guard Registry Key

When Control Flow Guard is configured for individual applications (either via Windows Security or PowerShell), Windows writes the mitigation flags under Image File Execution Options (IFEO):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<ExecutableName.exe>

• Value Name: MitigationOptions
• Value Name (Audit): MitigationAuditOptions
• Type: REG_BINARY or REG_QWORD
• Function: Overrides system defaults for the specified executable (<ExecutableName.exe>). The bitmask defines whether CFG is enabled (ON), disabled (OFF), or forced on modules compiled without CFG (Strict CFG).

Enterprise and Group Policy Exploit Guard Key

When Exploit Protection settings are deployed centrally via Group Policy or Microsoft Intune, the configuration XML path is defined under the Windows Defender policy key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exploit Guard\Exploit Protection

• Value Name: ExploitProtection_Settings
• Type: REG_SZ or REG_EXPAND_SZ
• Function: Points to the file path or schema containing the XML-formatted mitigation rules that enforce CFG and other Exploit Guard mitigations across the system.

Recommended Management Method

Because the MitigationOptions values use complex 64-bit binary bitmasks, modifying the raw hex values directly in regedit can lead to misconfigurations. The recommended administrative method to manipulate these keys is via PowerShell cmdlets:

• View settings: Get-ProcessMitigation -Name <ExecutableName.exe>
• Enable CFG: Set-ProcessMitigation -Name <ExecutableName.exe> -Enable CFG
• Disable CFG: Set-ProcessMitigation -Name <ExecutableName.exe> -Disable CFG