Add DEP setting

[sztanpet]

This script almost has everything I usually do on a new install, except a setting that switches DEP (Data Execution Prevention) to OptOut which is not the default because of legacy stuff.
Since this setting has multiple options not just enable/disable, I do not know how this should be integrated into your script, so I will leave this to you if you think it's worth the effort to add it.
The way I did it is as barebones as possible:

Function EnableDEP {
	Write-Host "Switching DEP to OptOut..."
	& $env:WINDIR\system32\bcdedit /set nx OptOut | Out-Null
}

[Disassembler0]

Hmm. Correct me if I'm wrong, but OptOut still leaves DEP enabled for all applications and just allows user-supplied exclusion list. So the user still needs to manually add the excluded apps.

Is there any benefit using this tweak without any specific app? I mean, the tweak is simple and clear enough, but I don't see any real effect without additional manual intervention. What's your use case?

[sztanpet]

by default DEP is opt-in and programs must volunteer for it, this reverses that thus making it a whitelist and more security (or I am misunderstanding something)

or in other words: I want DEP to be always on except when I let a program not use it

[Disassembler0]

Ah, OK, my mistake then. For some reason I thought the default is AlwaysOn. In that case your suggestion makes perfect sense and I'll add the tweak to next release on May 8. Thanks.

[Zero3]

@sztanpet @Disassembler0 I think the assumption by Win10-Initial-Setup-Script about DEP not being enabled by default might be wrong. Are you guys sure that is it not enabled by default in Windows 10? It appears to be so on the machines I checked, and https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/boot-parameters-to-configure-dep-and-pae seems to indicate the same (even though it does not say so directly).

[Disassembler0]

@Zero3: DEP has 4 levels and their naming is IMO a bit confusing. The level which is set by default is "OptIn", which enables DEP only for Windows components and services and leaves it disabled for other applications. The level which the tweak sets is "OptOut", which enables the DEP for all applications except the ones which are explicitly excluded.

So

• 0 = AlwaysOff = DEP is always off (duh).
• 1 = AlwaysOn = DEP is always on. No exceptions.
• 2 = OptIn = DEP is enabled for Windows components and services, user can select other applications to opt-in for DEP (ie. DEP whitelist). This is the default level.
• 3 = OptOut = DEP is enabled for all applications, user can select applications to opt-out of DEP (ie. DEP blacklist). This is the level which the script sets.

Source: https://support.microsoft.com/en-us/help/912923/how-to-determine-that-hardware-dep-is-available-and-configured-on-your

The premise is that the days of DEP-incompatible applications are long gone and there is no need to not have the DEP always on as a safety measure, however there still can be some exotic use cases, so we still want to allow user to add an exclusion.

So yes, the DEP is enabled by default, but the tweak enables it even more. :)

[Zero3]

@Disassembler0 I went digging, and found a credible source that explains our confusion about the default value:

On 64-bit versions of Windows, execution protection is always applied to all 64-bit processes and device drivers and can be disabled only by setting the nx BCD option to AlwaysOff. Execution protection for 32-bit programs depends on system configuration settings, described shortly.
[...]
On Windows client versions (both 64-bit and 32-bit), execution protection for 32-bit processes is configured by default to apply only to core Windows operating system executables. That is, the nx BCD option is set to OptIn. [...] On Windows server systems, execution protection for 32-bit applications is configured by default to apply to all 32-bit programs. That is, the nx BCD option is set to OptOut.

(Source: Windows Internals, 7th edition, Part 2. See https://books.google.dk/books?id=y83LDgAAQBAJ&lpg=PT128&dq=Windows%20Internals%20part%202&hl=da&pg=PT491#v=onepage&q&f=false)

So in pragmatic terms: This setting is only relevant for 32-bit processes running on client (not server) versions of Windows.

Perhaps the comment in Win10-Initial-Setup-Script could be updated to reflect some of this knowledge, so that it is easier to determine the relevance of the tweak? :)

[Disassembler0]

@Zero3: How would you propose to change the comment in order to reflect what's going on without being overly specific and possibly confusing? The comments, as they are now, are basically taken from the labels of the actual UI controls and IMO are not that misleading.

Set Data Execution Prevention (DEP) policy to OptOut (Turn on DEP for all programs and services except selected)

Does pretty much as it says. The only thing which it doesn't explicitly say is that the exclusion can be done for 32-bit program, which is not that important, because all 64-bit executables are inherently DEP-compatible and there is no need to exclude them.

Set Data Execution Prevention (DEP) policy to OptIn (Turn on DEP for essential Windows programs and services only)

Arguably, this can be a bit misleading as 64-bit executables have DEP enabled at all times even with this option.

So what would you like to see in the comments?

[Zero3]

@Disassembler0 currently the description says:

Set Data Execution Prevention (DEP) policy to OptOut (Turn on DEP for all programs and services except selected)

In my opinion, something like this would be a significant improvement:

Set Data Execution Prevention (DEP) policy for legacy 32-bit executables to OptOut. This is the default on Windows Server, but not on Windows 10, where the default is OptIn. OptOut enables DEP for all 32-bit executables (except any manually added exclusions) while OptIn only enables DEP for core Windows executables (as well as any manually added inclusions).

This is just a suggestion, of course. It's your call :).

[Disassembler0]

Such long comments in code are appropriate usually just when the tweak can break or block some functionality or create unexpected situation for the user. Since you're the first one to voice an opinion about the DEP tweak since May 2017, I'm gonna assume that this is not the case and leave it for "extended docs" such as the planned wiki (#225) and just mention the bitness in the comments for now.

Apropos, what prompted you to search for what that setting actually does? Do you have a real-world use case where the DEP needs to remain OptIn or were you just curious?

[Zero3]

@Disassembler0

Apropos, what prompted you to search for what that setting actually does? Do you have a real-world use case where the DEP needs to remain OptIn or were you just curious?

It is enabled by default in Default.preset, so I wanted to make sure I understood what it did before I executed it. The DEP security setting does not sound like something one wants to mess with without understanding the implications.

The larger picture: While most of the names of the tweaks make it pretty clear what they do, I find myself constantly using the comments in Win10.psm1 to figure out exactly what they do, and whether I want to use them or not. I somewhat quickly realized that reading the comments in that file is kind of mandatory, as several of the tweaks have important information and caveats hidden away there.

For me, ideally, these comments would be placed next to the tweaks in the default preset file, just like they are in config files for a lot of software. I'd also rather have 5-10 lines of comments for each tweak (if relevant) than 1 and having to research the rest by myself.