How to Check if Data Execution Prevention (DEP) is Enabled in Batch Script

Data Execution Prevention (DEP) is a system-level security feature that prevents malicious code from running in protected memory regions. By marking certain memory areas as "Non-executable," DEP stops viruses and other exploits from using buffer overflow attacks to hijack your system. For IT administrators and security engineers, verifying that DEP is active and correctly configured is a vital part of system hardening. This guide explains how to audit your DEP status using Batch and WMI.

Why Validate DEP Status?

Exploit Mitigation: Ensuring your system is protected against the most common types of memory-injection malware.
Application Compatibility Audit: Identifying if an older, legacy application is crashing because DEP is correctly blocking its non-standard memory usage.
Security Compliance: Meeting the requirements for modern security baselines which mandate that DEP be active for all system processes.

Hardware vs. Software DEP

Hardware-enforced DEP requires a CPU that supports NX (No-Execute) or XD (Execute Disable) bits. Most processors made after 2005 support this, but it must also be enabled in your BIOS/UEFI.

Method 1: Using WMI (The Easiest Way)

The Win32_OperatingSystem class provides two critical pieces of info: if the hardware supports DEP and what the current system policy is.

@echo off
setlocal EnableDelayedExpansion

echo [PROCESS] Querying Data Execution Prevention (DEP) status...
echo.

:: Check hardware availability
set "DEP_AVAIL="
for /f "tokens=2 delims==" %%a in ('wmic OS get DataExecutionPrevention_Available /value 2^>nul ^| find "="') do (
    for /f "delims=" %%b in ("%%a") do set "DEP_AVAIL=%%b"
)

:: Check policy level
set "DEP_POLICY="
for /f "tokens=2 delims==" %%a in ('wmic OS get DataExecutionPrevention_SupportPolicy /value 2^>nul ^| find "="') do (
    for /f "delims=" %%b in ("%%a") do set "DEP_POLICY=%%b"
)

:: Display results
if /i "!DEP_AVAIL!"=="TRUE" (
    echo [PASS] Hardware DEP: Available
) else (
    echo [WARN] Hardware DEP: Not available ^(check BIOS NX/XD setting^)
)

echo.
if "!DEP_POLICY!"=="1" echo [INFO] Policy: AlwaysOn - Full protection for all processes
if "!DEP_POLICY!"=="2" echo [INFO] Policy: OptIn - Protection for Windows system files and specified apps
if "!DEP_POLICY!"=="3" echo [INFO] Policy: OptOut - Protection for all processes except those specified
if "!DEP_POLICY!"=="0" echo [FAIL] Policy: AlwaysOff - DEP is DISABLED (Critical Security Risk!)

if not defined DEP_POLICY echo [ERROR] Could not determine DEP policy.

pause

Method 2: Detailed Reporting via PowerShell

If you want a more human-readable report from your Batch script, you can use a small PowerShell bridge to interpret the policy numbers.

@echo off
setlocal EnableDelayedExpansion

echo ============================================================
echo   Data Execution Prevention (DEP) Security Audit
echo ============================================================
echo.
echo Computer: %COMPUTERNAME%
echo Date:     %date% %time%
echo.
echo ============================================================
echo.

echo [AUDIT] Checking memory protection status...
echo.

:: Build PowerShell command with proper structure
set "PSCmd=$os = Get-CimInstance Win32_OperatingSystem;"
set "PSCmd=!PSCmd! $avail = $os.DataExecutionPrevention_Available;"
set "PSCmd=!PSCmd! $policy = $os.DataExecutionPrevention_SupportPolicy;"
set "PSCmd=!PSCmd! Write-Host '';"
set "PSCmd=!PSCmd! if ($avail) {"
set "PSCmd=!PSCmd!   Write-Host '[PASS] Hardware DEP: Available' -ForegroundColor Green"
set "PSCmd=!PSCmd! } else {"
set "PSCmd=!PSCmd!   Write-Host '[WARN] Hardware DEP: Not Available' -ForegroundColor Yellow"
set "PSCmd=!PSCmd!   Write-Host '        Hardware does not support DEP' -ForegroundColor Yellow"
set "PSCmd=!PSCmd! };"
set "PSCmd=!PSCmd! Write-Host '';"
set "PSCmd=!PSCmd! $policyName = switch($policy) {"
set "PSCmd=!PSCmd!   0 { 'DISABLED - Critical Security Risk!' }"
set "PSCmd=!PSCmd!   1 { 'AlwaysOn - Full Protection' }"
set "PSCmd=!PSCmd!   2 { 'OptIn - Standard (Windows default)' }"
set "PSCmd=!PSCmd!   3 { 'OptOut - Aggressive Protection' }"
set "PSCmd=!PSCmd!   default { 'Unknown' }"
set "PSCmd=!PSCmd! };"
set "PSCmd=!PSCmd! Write-Host \"DEP Policy:  $policyName (Code: $policy)\";"
set "PSCmd=!PSCmd! Write-Host '';"
set "PSCmd=!PSCmd! switch($policy) {"
set "PSCmd=!PSCmd!   0 {"
set "PSCmd=!PSCmd!     Write-Host '[CRITICAL] DEP is DISABLED!' -ForegroundColor Red;"
set "PSCmd=!PSCmd!     Write-Host '           System is vulnerable to buffer overflow attacks' -ForegroundColor Red;"
set "PSCmd=!PSCmd!     Write-Host '           Action: Enable DEP immediately' -ForegroundColor Red;"
set "PSCmd=!PSCmd!     exit 2"
set "PSCmd=!PSCmd!   }"
set "PSCmd=!PSCmd!   1 {"
set "PSCmd=!PSCmd!     Write-Host '[EXCELLENT] DEP is enabled for all processes' -ForegroundColor Green;"
set "PSCmd=!PSCmd!     Write-Host '            Maximum protection active' -ForegroundColor Green;"
set "PSCmd=!PSCmd!     exit 0"
set "PSCmd=!PSCmd!   }"
set "PSCmd=!PSCmd!   2 {"
set "PSCmd=!PSCmd!     Write-Host '[GOOD] DEP enabled for Windows components only' -ForegroundColor Cyan;"
set "PSCmd=!PSCmd!     Write-Host '       Third-party applications may not be protected' -ForegroundColor Cyan;"
set "PSCmd=!PSCmd!     Write-Host '       Consider upgrading to OptOut (policy 3)' -ForegroundColor Cyan;"
set "PSCmd=!PSCmd!     exit 0"
set "PSCmd=!PSCmd!   }"
set "PSCmd=!PSCmd!   3 {"
set "PSCmd=!PSCmd!     Write-Host '[EXCELLENT] DEP enabled for all processes except exclusions' -ForegroundColor Green;"
set "PSCmd=!PSCmd!     Write-Host '            High security configuration' -ForegroundColor Green;"
set "PSCmd=!PSCmd!     exit 0"
set "PSCmd=!PSCmd!   }"
set "PSCmd=!PSCmd!   default {"
set "PSCmd=!PSCmd!     Write-Host '[UNKNOWN] Cannot determine DEP status' -ForegroundColor Yellow;"
set "PSCmd=!PSCmd!     exit 1"
set "PSCmd=!PSCmd!   }"
set "PSCmd=!PSCmd! }"

:: Execute PowerShell command
powershell -NoProfile -ExecutionPolicy Bypass -Command "!PSCmd!"

set "AuditResult=!errorlevel!"

echo ============================================================
echo   Audit Summary
echo ============================================================
echo.

if !AuditResult! equ 0 (
    echo Status: COMPLIANT
    echo        DEP is properly configured
) else if !AuditResult! equ 2 (
    echo Status: CRITICAL - ACTION REQUIRED
    echo        DEP is disabled or misconfigured
) else (
    echo Status: WARNING
    echo        Unable to determine DEP status
)

echo.
echo ============================================================
echo.

pause
endlocal
exit /b !AuditResult!

Creating a Security Baseline Auditor

A professional script checks for hardware availability, interprets the policy level, and provides actionable guidance.

@echo off
setlocal EnableDelayedExpansion

echo ============================================================
echo   Memory Integrity ^& DEP Policy Auditor
echo ============================================================

:: 1. Check Hardware Availability
echo.
echo [CHECK 1] Hardware DEP Support:
set "HW_DEP="
for /f "tokens=2 delims==" %%a in ('wmic OS get DataExecutionPrevention_Available /value 2^>nul ^| find "="') do (
    for /f "delims=" %%b in ("%%a") do set "HW_DEP=%%b"
)

if /i "!HW_DEP!"=="TRUE" (
    echo   [PASS] Hardware NX/XD bit support detected.
) else (
    echo   [WARN] Hardware DEP not available.
    echo   [HELP] Check BIOS for 'NX', 'XD', or 'No-Execute Memory Protection'.
)

:: 2. Check Policy Level
echo.
echo [CHECK 2] DEP Policy Configuration:
set "POLICY="
for /f "tokens=2 delims==" %%a in ('wmic OS get DataExecutionPrevention_SupportPolicy /value 2^>nul ^| find "="') do (
    for /f "delims=" %%b in ("%%a") do set "POLICY=%%b"
)

if "!POLICY!"=="0" (
    echo   [FAIL] Policy: AlwaysOff - DEP IS DISABLED.
    echo   [ACTION] Enable DEP immediately with:
    echo           bcdedit /set {current} nx OptIn
    echo           (Requires Administrator privileges and a reboot)
) else if "!POLICY!"=="1" (
    echo   [PASS] Policy: AlwaysOn - Maximum protection.
) else if "!POLICY!"=="2" (
    echo   [PASS] Policy: OptIn - Standard Windows protection.
) else if "!POLICY!"=="3" (
    echo   [PASS] Policy: OptOut - Aggressive protection.
) else (
    echo   [ERROR] Could not determine DEP policy.
)

:: 3. Summary
echo.
echo ============================================================
if /i "!HW_DEP!"=="TRUE" if defined POLICY if "!POLICY!" neq "0" (
    echo   OVERALL: Memory protection is ACTIVE.
) else (
    echo   OVERALL: Memory protection has ISSUES. Review above.
)
echo ============================================================
pause

Common Pitfalls and How to Avoid Them

Administrative Rights

Querying the Win32_OperatingSystem class via WMI generally works for all users, but some enterprise configurations might restrict access to sensitive security fields. Run as Administrator for the most reliable results.

BIOS Settings (NX Bit)

If DataExecutionPrevention_Available returns FALSE, it doesn't always mean your CPU is old. It often means the NX bit is disabled in your BIOS.

Wrong Way:

:: Assuming the computer is "non-secure" and cannot be fixed.

Correct Way: Advise the user to reboot and enter the BIOS/UEFI settings to look for "NX," "XD," or "No-Execute Memory Protection" and toggle it to Enabled.

SEO and UX Tip

Advise your users that for maximum security (e.g., on a high-risk server), the policy should be set to 1 (AlwaysOn). However, be aware that this can break some older, poorly-written drivers or applications.

Best Practices for Memory Security

Use 64-bit Windows: Hardware DEP is more rigorously enforced and harder to bypass in 64-bit environments.
Monitor Crash Logs: If an application crashes with a "Memory Access Violation" error, check your audit script. DEP might be doing its job by blocking suspicious behavior from that app.
Combine with ASLR: DEP is most effective when paired with Address Space Layout Randomization (ASLR). Use your script to check both settings for a complete memory-security audit.

BCDedit

Note that you can change the DEP level via the command bcdedit /set {current} nx <policy>. This requires a reboot to take effect.

Conclusion

Checking if Data Execution Prevention (DEP) is enabled via Batch script is a fundamental requirement for maintaining a secure and stable Windows environment. By accurately identifying both hardware support and the current system policy, you can ensure that your machines are protected against memory-level exploits and "Zero-Day" buffer overflow attacks. This professional approach to system identification maintains the security integrity of your organization, providing a clear, automated view of your memory protection status and ensuring your infrastructure remains resilient against advanced digital threats.

Why Validate DEP Status?​

Method 1: Using WMI (The Easiest Way)​

Method 2: Detailed Reporting via PowerShell​

Creating a Security Baseline Auditor​

Common Pitfalls and How to Avoid Them​

Administrative Rights​

BIOS Settings (NX Bit)​

Best Practices for Memory Security​

Conclusion​

Table of Contents