Bill Bosacker

This is just my normal user blog for things that don't fit in the other blogs, but are tailored for the open source C/C++/C# and .NET communities. It is also included in the mirrored aggregate blogs on this site, so you don't need to include it seperately.

Windows Server 2008: Data Execution Prevention (DEP)

I believe that this software was first introduced to windows with Windows 2000 and used to default to "Turn on DEP for essential Windows programs and services only", but this has changed with Windows Vista Ultimate and Windows Server 2008.  It is now defaulting to "Turn on DEP for all programs and services except those I select:", which can cause the installation of some applications to fail.  Here is some text from the help file that describes how DEP works:

"DEP can help protect your computer by monitoring your programs to make sure that they use system memory safely. If DEP notices a program on your computer using memory incorrectly, it closes the program and notifies you."

Unfortunately, the DEP software does not always do this.  It does not always inform you that it has taken action and closed a program, which can cause the application that you are running to fail for an unknown reason.  I have never had a virus on any system that I am 100% in control of, so I decided to set it back to the old default setting and leave it there.  At the very least, you can change the setting just to install the application that you are having trouble with and then set it back after it is installed.  A reboot is required everytime the setting is changed.

If anyone has any additional feedback on this I'd like to hear your thoughts.

Posted: Jun 13 2008, 12:51 PM by Bill Bosacker | with 2 comment(s)

Comments

Markus Orchowski said:

I write a ton of vbscripts to help with system administration.

Up until just today no problems now DEP will not allow any VB Scripts to run.  Even after I change the settings to "Turn on DEP for essential Windows programs and services only".  Originally I tried to allow wscript.exe to be allowed, but this problem is explicitly denied and can't be allowed.

I feel completely handicapped without the ability to run my scripts.

# November 18, 2008 2:32 PM

Bill Bosacker said:

Hey Markus, are you sure that it is the DEP that is preventing your VB scripts from running?  It may be the UAC or even IE that is preventing them from running.  The companies that I've done business for don't allow VB Scripts to be run due to their virus potential.  If you can, the best options would be to either convert them to Windows PowerShell scripts, or write a .NET application to do the work.

# November 18, 2008 2:57 PM
Leave a Comment

(required) 

(required) 

(optional)

(required)