Kernel-mode Hardware-enforced Stack Protection is a Windows 11 security feature that uses your CPU to catch a common type of memory attack before it runs malicious code. It is easy to switch on, but it can stop some drivers from loading, especially game anti-cheat tools. If a driver conflict leaves a game failing to launch, our Windows 11 game crashes fix covers other common causes.
Here is how it works, which PCs support it, how to enable it, and what to do if something breaks.
What the Feature Does
The feature mainly defends against stack buffer overflow attacks. In these attacks, an attacker overflows a temporary memory area called a buffer so they can overwrite a program's return address or control data. Redirecting a program's execution this way is known as Return-Oriented Programming (ROP), and it lets attackers run code of their choosing.
To stop this, Windows uses a hardware-backed Shadow Stack. This is a protected copy of the normal call stack that applications cannot modify. It works in four steps:
- Call: When a function is called, its return address is saved on both the normal stack and the Shadow Stack.
- Compare: When the function returns, Windows checks that the two addresses match.
- Match: If they match, the program continues normally.
- Mismatch: If they differ, Windows treats it as a possible attack and terminates the process.
Because the check does not depend on knowing a specific exploit, it can help against unknown flaws, including zero-days. The feature debuted in Windows 11 22H2, and Microsoft delivered it through a Defender update in April 2023.
Requirements
| Requirement | Details |
|---|---|
| Operating system | Windows 11 22H2 or later, fully updated |
| CPU | Intel Tiger Lake or newer, or AMD Zen 3 or newer (needs Intel CET-style shadow stack support) |
| BIOS setting | CPU virtualization enabled |
| Compatible drivers | No loaded drivers that conflict with the feature |
If the toggle is missing, your CPU may not support it or virtualization may be off in the BIOS or UEFI.
How to Enable It
- Open Windows Security and go to Device security, then Core isolation.
- Find the setting: If your hardware qualifies and virtualization is on, you will see Kernel-mode Hardware-enforced Stack Protection.
- Toggle it On: Windows then scans loaded drivers for conflicts.
- Resolve conflicts: If incompatible drivers are found, Windows asks you to review the list and update them first. After updating, try again.
- Restart: If no conflicts appear, Windows may ask you to restart to finish enabling it.
In the screenshot, Memory integrity is already on, while Kernel-mode Hardware-enforced Stack Protection is off and shows a warning that the device may be vulnerable. You can dismiss the warning or flip the switch to enable it.
Possible Problems: Driver Conflicts
Sometimes Windows does not know a driver is incompatible and lets you enable the feature anyway. A crash is possible, but it is more common that a program simply will not launch. Windows then reports that a driver cannot load and offers to disable the protection.
The prompt shown above names the blocked driver (BEDaisy.sys) and gives a Disable button. Windows warns that clicking it will downgrade your device's security. BEDaisy.sys is generally associated with the BattlEye anti-cheat system, though that detail is our addition and not from the original tutorial.
Games Reported to Conflict
In 2023, users reported conflicts mostly with anti-cheat and copyright-protection drivers in these games:
- PUBG
- Valorant (Riot Vanguard)
- Bloodhunt
- Destiny 2
- Genshin Impact
- Phantasy Star Online 2 (Game Guard)
- DayZ
Should You Turn It On?
- Work and general-use PCs: Usually a good idea if your CPU supports it and no drivers conflict.
- Gamers with anti-cheat titles: Update your drivers and games first, then test one game at a time. If one fails to launch, you can turn the feature off again. For performance tuning afterward, see our Windows 11 gaming optimization guide.
- Older PCs: The setting will likely not appear, and there is nothing to enable.
Why This Matters
Hardware-backed protections are harder for attackers to bypass than software-only checks, and they can stop exploits for flaws nobody has found yet. The cost is compatibility, because drivers must be written to work with shadow stacks. The original reporting expected anti-cheat and copy-protection makers to update their drivers as adoption grew. If you are checking whether your PC meets other hardware-based security requirements, our guide to enabling hardware-accelerated GPU scheduling is another settings walkthrough worth reading.
Official source: Microsoft: Understanding Hardware-enforced Stack Protection.
Frequently Asked Questions (FAQ)
What is Kernel-mode Hardware-enforced Stack Protection?
It is a Windows 11 security feature that uses CPU-backed Shadow Stacks to detect and block return-address tampering, such as stack buffer overflow and ROP attacks.
Why can't I see the setting?
Your CPU may not support it (you need Intel Tiger Lake or AMD Zen 3 or newer), or CPU virtualization may be disabled in the BIOS. Make sure Windows 11 is fully updated too.
Why won't it turn on?
Windows found drivers that conflict with it. Update the listed drivers to the latest versions, then try again.
Will it break my games?
It might, mainly where an anti-cheat or copy-protection driver is incompatible. The usual symptom is a game that will not launch, with a prompt naming the driver.
How do I turn it off?
Return to Windows Security, then Core isolation, and toggle the setting off, or click Disable on the compatibility prompt and restart. Doing so lowers your protection.
No comments:
Post a Comment