Kernel protection
since 0.9.8.11
Purpose
This page lists every setting of the “Kernel protection” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.
7 settings.
Notes
Enable Structured Exception Handling Overwrite Protection (SEHOP)
A REG_DWORD value of 0 enables Structured Exception Handling Overwrite Protection (SEHOP) system-wide. SEHOP mitigates exploits that use memory corruption to alter the chain of Windows Structured Exception Handling (SEH) handlers.
- Technical:
- Registry value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\DisableExceptionChainValidation = 0 (REG_DWORD)
- Registry value:
- Switch in the app: Policies › Kernel protection
- In detail: Enable Structured Exception Handling Overwrite Protection (SEHOP)
- Source: Microsoft Learn: Exploit protection reference – Validate exception chains (SEHOP)
- Recommended by: Windows 11 v25H2 Security Baseline
Turn On Virtualization Based Security
This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Kernel protection
- In detail: Turn On Virtualization Based Security
- Source: Microsoft Learn: Policy CSP – DeviceGuard
- Recommended by: Windows 11 v25H2 Security Baseline · ACSC/ASD: Hardening Microsoft Windows 11 workstations · BSI SiSyPHuS Win10, Arbeitspaket 11: Konfigurationsempfehlungen zur Härtung von Windows 10 mit Bordmitteln, Abschnitt 5.2.2.1 · CIS Benchmark (Windows 11) · Microsoft Learn
Turn On Virtualization Based Security
This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HVCIMATRequired = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Kernel protection
- In detail: Turn On Virtualization Based Security
- Source: Microsoft Learn: Policy CSP – DeviceGuard
- Recommended by: Windows 11 v25H2 Security Baseline
Turn On Virtualization Based Security
This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureSystemGuardLaunch = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Kernel protection
- In detail: Turn On Virtualization Based Security
- Source: Microsoft Learn: Policy CSP – DeviceGuard
- Recommended by: Windows 11 v25H2 Security Baseline
Turn On Virtualization Based Security
This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Kernel protection
- In detail: Turn On Virtualization Based Security
- Source: Microsoft Learn: Policy CSP – DeviceGuard
- Recommended by: Windows 11 v25H2 Security Baseline · ACSC/ASD: Hardening Microsoft Windows 11 workstations · BSI SiSyPHuS Win10, Arbeitspaket 11: Konfigurationsempfehlungen zur Härtung von Windows 10 mit Bordmitteln, Abschnitt 5.2.2.1 · CIS Benchmark (Windows 11) · Microsoft Learn
Turn On Virtualization Based Security
This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureKernelShadowStacksLaunch = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Kernel protection
- In detail: Turn On Virtualization Based Security
- Source: Microsoft Learn: Policy CSP – DeviceGuard
- Recommended by: Windows 11 v25H2 Security Baseline
Turn On Virtualization Based Security
This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Kernel protection
- In detail: Turn On Virtualization Based Security
- Source: Microsoft Learn: Policy CSP – DeviceGuard
- Recommended by: Windows 11 v25H2 Security Baseline · BSI SiSyPHuS Win10, Arbeitspaket 11: Konfigurationsempfehlungen zur Härtung von Windows 10 mit Bordmitteln, Abschnitt 5.2.2.2 · Microsoft Learn