Windows Exploit Protection Heap Mitigation Registry Key

This article outlines the specific Windows Registry keys responsible for managing Exploit Protection heap mitigations in Windows Defender. It details the precise paths under the Registry Editor (Regedit), the relevant data values used to enforce protections like Heap Integrity and Terminate on Heap Corruption, and how Windows stores these security policies per application and across the entire system.

Per-Application Heap Mitigation Registry Key

Windows Defender Exploit Protection stores per-process mitigation policies—including heap-specific mitigations—under the Image File Execution Options (IFEO) key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<ApplicationName.exe>

Replace <ApplicationName.exe> with the executable name of the target process (for example, chrome.exe or runtimebroker.exe).

Key Values for Heap Mitigations

Within the target application’s key, Exploit Protection stores a bitmask of enabled and disabled mitigations in the following values:

• MitigationOptions: A REG_BINARY or REG_QWORD value representing a bitmask of active mitigations. Heap mitigations, such as Terminate on heap corruption (Heap Termination) and Enable heap integrity validation, correspond to specific bit positions in this mask.
• MitigationAuditOptions: A REG_BINARY or REG_QWORD value used when mitigations are configured in “Audit” mode rather than “Enforce” mode.

System-Wide Exploit Protection Registry Key

To manage system-wide default mitigations applied across all applications that do not have custom overrides, Windows utilizes:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel

Under this key, general kernel-level mitigation flags are set, including system-wide Data Execution Prevention (DEP) and Structured Exception Handler Overwrite Protection (SEHOP), which interact directly with memory and heap safety.

Managing Mitigations via PowerShell

Because the MitigationOptions binary mask contains complex bit flags, manual editing in Regedit can be error-prone. The underlying keys can be safely viewed and updated using built-in PowerShell commands:

• View settings: Get-ProcessMitigation -Name <ApplicationName.exe>
• Enable heap termination: Set-ProcessMitigation -Name <ApplicationName.exe> -Enable HeapTerminate
• Disable heap termination: Set-ProcessMitigation -Name <ApplicationName.exe> -Disable HeapTerminate

Executing these commands automatically updates the corresponding binary entries inside the Image File Execution Options registry path.