Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Disabling Data Execution Prevention (DEP) in Windows 11 does not stop Windows from running, and it does not reliably make a given program work. What it removes is a memory protection. DEP blocks code from running out of memory pages that are meant to hold data, a step that memory-corruption exploits depend on. Switching it off weakens that defense for the scope you choose, which may be the whole system or only selected processes depending on the configured policy. Any compatibility gain belongs to one specific app and configuration, so it has to be tested rather than assumed.
What DEP protects, and what turning it off removes
DEP combines hardware and software checks on memory. Where hardware enforcement is available, Windows marks process memory as non-executable unless that memory explicitly contains executable code. If code tries to run from a non-executable region, Windows can raise an exception instead of letting the code run. Because the check happens at runtime, it applies even to code that was not built with newer protections.
As an Amazon Associate I earn from qualifying purchases.
Disabling DEP removes that check for the affected scope. It is one mitigation among several. Windows documents separate protections such as SEHOP and ASLR, and those are separate features; a DEP change neither replaces them nor turns them off. DEP is not a complete antivirus feature, and turning it off does not guarantee infection. It simply means a class of memory-based attack is no longer blocked at that layer.
Free tools Windows power users keep installed
One-click scans. No signup required.
The four boot policy values
Microsoft documents four nx boot policy values in its Boot Parameters to Configure DEP and PAE documentation, last updated 2021-12-14. The table summarizes how each one behaves.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
| Value | What it applies to | Per-app exemptions | Effect on attempts to change DEP |
|---|---|---|---|
OptIn |
Windows components and services | Not stated in Microsoft’s summary | Not stated in Microsoft’s summary |
OptOut |
The operating system and all processes | Administrators can exempt selected applications | Not stated in Microsoft’s summary |
AlwaysOn |
DEP stays enabled | Not stated in Microsoft’s summary | Attempts to disable DEP are ignored |
AlwaysOff |
DEP is disabled broadly | Not applicable; selective enablement is ignored | Attempts to enable DEP selectively are ignored |
The value you see in practice depends on the configured boot policy and on any application-specific mitigation policy. AlwaysOff is therefore a broad change, not a per-app exception. Microsoft’s page states:
“DEP is a highly effective security feature that should not be disabled unless you have no alternative.”
Rank #2
Dell Latitude 5420 14" FHD Business Laptop Computer, Intel Quad-Core i5-1145G7, 16GB DDR4 RAM, 256GB SSD, Camera, HDMI, Windows 11 Pro (Renewed)
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
The same page says the defaults are optimal for most systems and advises against changing them unless they interfere with essential processing tasks.
What actually breaks, and what does not
- Windows itself. Disabling DEP does not, by itself, stop Windows 11 from starting or signing in.
- Programs that depend on running code from data memory. These may crash, fail to start, or report an exception. Microsoft’s documentation does not name current Windows 11 applications that require DEP to be off, so no specific app list can be confirmed from that source.
- Other programs in scope. A system-wide change removes the check for every process in that scope, not only the one you were troubleshooting.
- Unrelated failures. If the crash has a different cause, such as a missing library or a bad driver, turning DEP off will not fix it and only adds exposure.
- Boot-level mistakes. Incorrect boot configuration changes can leave the computer unable to start. Microsoft also notes that BitLocker or Secure Boot may need to be suspended or disabled before some settings can be changed.
No published figure from Microsoft’s documentation quantifies how often DEP causes compatibility problems, so the likelihood for your specific program is unknown until you test it.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Confirm DEP is the cause before changing anything
- Record the program’s exact name, its executable file name, its version, and your Windows 11 build. Press Windows key + R, type
winver, and press Enter to read the build number. - Note the exact symptom: a crash, an exception message, or a failure to launch. Open Event Viewer and go to Windows Logs > Application. Look for the faulting module and the exception code near the time of the failure.
- Open Windows PowerShell as administrator and run
Get-ProcessMitigation -System. Find the DEP entry. A value ofNOTSETmeans the system-level default applies. - Check for an app-specific override with
Get-ProcessMitigation -Name yourapp.exe, replacing the name with the program’s executable file name. - Open Windows Security > App & browser control > Exploit protection > Program settings and confirm whether the program has its own entry.
- Reproduce the problem on a test machine or virtual machine before changing a production PC. Microsoft recommends testing process mitigations in a test lab before deploying them to an organization, to see whether required apps are affected.
If the failure does not reproduce with DEP enabled, the mitigation is probably not the cause, and the change is unnecessary.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If a change is unavoidable: start narrow
Option 1: a per-app override
A per-app exemption limits the change to one named program. It only takes effect when the boot policy allows selective control, because AlwaysOn and AlwaysOff override per-app settings in their respective directions. To remove an override and return the program to the system-level value, run this in an elevated PowerShell window:
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Set-ProcessMitigation -Name yourapp.exe -Remove
Document the program name, the date, and the reason for any exemption so that it can be reviewed later.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOption 2: a system-wide boot setting (last resort)
A system-wide change uses the Boot Configuration Data store and requires administrator rights. Before you change anything, record the current value and export a backup of the boot configuration:
Best Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
bcdedit /enum {current}
bcdedit /export C:bcd-backup
If BitLocker is enabled, suspend protection first from Control Panel > BitLocker Drive Encryption > Suspend protection, so the recovery key is not required on the next start. Then set the value. The command below sets AlwaysOff, which disables DEP broadly:
bcdedit /set nx AlwaysOff
Restart the PC for the change to take effect. To reverse it, set the value you recorded from the enum output, for example bcdedit /set nx OptIn if that was the original value, then restart and rerun Get-ProcessMitigation -System to confirm. If the machine will not start, use the backup you exported and Windows recovery options rather than repeating commands from unverified sources.
Microsoft’s documentation does not name a current Windows 11 program that needs DEP disabled. Compatibility guidance for a specific app should come from that app’s vendor, and the narrowest change that the vendor’s guidance supports is the one to test first.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
