How to Enable Arbitrary Code Guard in Regedit

This article explains how to enforce Arbitrary Code Guard (ACG) on specific executable files using the Windows Registry Editor. ACG is an exploit mitigation feature in Windows that blocks dynamic code generation and modification, preventing malicious actors from executing unmanaged or injected code in memory. By adding specific registry keys and mitigation flags under Image File Execution Options, administrators can enforce ACG on targeted applications.

Prerequisites and Caution

Modifying the Windows Registry can affect system stability. Ensure you back up the registry before proceeding. Note that enforcing ACG on applications that rely on Just-In-Time (JIT) compilation (such as specific web browsers, Node.js, or Java runtimes) may cause those applications to crash or malfunction.

Step-by-Step: Enforcing ACG via Registry Editor

1. Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Enter.
  3. Select Yes if prompted by User Account Control (UAC).

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

3. Create a Key for the Target Executable

  1. Right-click on the Image File Execution Options key.
  2. Select New > Key.
  3. Name the key with the exact file name of the application you want to target (for example, testapp.exe or notepad.exe).

4. Add the MitigationOptions Value

  1. Right-click the newly created key (e.g., testapp.exe).
  2. Select New > QWORD (64-bit) Value (or Binary Value depending on your Windows version).
  3. Name this new value: MitigationOptions

5. Set the Mitigation Flag for ACG

  1. Double-click the MitigationOptions value to modify it.
  2. Set the base to Hexadecimal.
  3. Enter the value corresponding to dynamic code prohibition (ACG).
    • To enable ACG (Disallow Dynamic Code), set the bitmask value to 0x100 (or 0000000000000100 in 64-bit hex format).
    • To also enforce thread dynamic code prohibition, combine it with strict ACG policies by setting the appropriate mask bits.
  4. Click OK to save the changes.

Verifying the Configuration

To confirm that ACG is active on the application:

  1. Open PowerShell as an Administrator.

  2. Run the following command (replace testapp.exe with your executable name):

    Get-ProcessMitigation -Name testapp.exe

  3. Locate the DynamicCode section in the output.

  4. Verify that ProhibitDynamicCode is set to ON.