How to Verify Shadow Stacks in Regedit

Hardware-enforced Stack Protection, also known as shadow stacks, is an advanced security feature that protects programs from control-flow hijacking techniques like Return-Oriented Programming (ROP). In Windows, you can verify whether shadow stacks are explicitly configured for critical processes by examining the Image File Execution Options inside the Registry Editor (regedit). This guide outlines the exact registry paths and values required to confirm that this mitigation is active.

Step 1: Open the Registry Editor

1. Press Win + R on your keyboard to open the Run dialog.
2. Type regedit and press Enter (or click OK).
3. Confirm the User Account Control (UAC) prompt to grant administrative privileges.

Step 2: Navigate to Image File Execution Options (IFEO)

Per-process exploit mitigations—including Hardware-enforced Stack Protection—are defined under the IFEO key. Paste the following path into the address bar at the top of the Registry Editor:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Step 3: Locate the Target Process

1. Expand the Image File Execution Options folder.
2. Scroll through the subkeys to find the executable name of the critical process you want to check (for example, lsass.exe, svchost.exe, msedge.exe, or custom business-critical binaries).
3. Click on the target process subkey.

Step 4: Check the Mitigation Values

Within the selected process key, look at the right-hand pane for specific mitigation entries:

1. MitigationOptions:
   • This REG_QWORD or REG_BINARY value stores bitmasks representing various exploit mitigations.
   • If User-Mode Hardware-enforced Stack Protection (UserShadowStack) is enabled, specific bits within this mask are set to 1 (enabled) rather than 0 or 2 (disabled).
2. MitigationAuditOptions:
   • If present, this entry indicates that the mitigation is running in audit-only mode to log potential violations without terminating the process.

(Note: If a process has no custom MitigationOptions entry, it defaults to the system-wide baseline configured via Windows Security / Exploit Protection settings).

Step 5: Verify Kernel-Mode Shadow Stack Support

To ensure the underlying operating system environment supports and enforces shadow stacks at the kernel level, navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel

Look for: * MitigationOptions: Contains the global kernel mitigation bitmask. * KernelShadowStacks (or related CET policies managed via Group Policy / MDM under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions).

Summary Checklist