> For the complete documentation index, see [llms.txt](https://docs.wicked.ws/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wicked.ws/troubleshooting/enable-aslr-dep-and-heap-protection.md).

# Enable ASLR, DEP, and heap protection

Windows Exploit Protection helps block common memory-based attacks. This guide enables **ASLR**, **DEP**, and heap protection across Windows.

{% hint style="info" %}
The Windows interface calls heap protection **Validate heap integrity**. It may also be called HOP.
{% endhint %}

{% hint style="warning" %}
These settings are requiered otherwise our services wont work as expected.
{% endhint %}

### Enable the protections

These steps are the same in Windows 10 and Windows 11.

{% stepper %}
{% step %}

#### Open Exploit Protection

Select **Start**. Search for `Exploit protection`, then open **Exploit protection settings**.

You can also open **Windows Security → App & browser control → Exploit protection**.
{% endstep %}

{% step %}

#### Enable DEP

Under **System settings**, find **Data Execution Prevention (DEP)**.

Select **On by default**, then select **Apply**.
{% endstep %}

{% step %}

#### Enable ASLR

Enable these settings, then select **Apply** after each change:

* **Randomize memory allocations (Bottom-up ASLR)**
* **Force randomization for images (Mandatory ASLR)**
  {% endstep %}

{% step %}

#### Enable heap protection

Find **Validate heap integrity**. Select **On by default**, then select **Apply**.

This setting provides heap protection for supported applications.
{% endstep %}

{% step %}

#### Restart Windows

Restart your computer to make sure all applications use the new settings.
{% endstep %}
{% endstepper %}

### Verify the settings

Return to **Windows Security → App & browser control → Exploit protection**. Confirm each setting shows **On by default**.

### If an application stops working

1. Open **Exploit protection settings → Program settings**.
2. Select the affected application, or use **Add program to customize**.
3. Restore the incompatible protection to its default value.

{% hint style="info" %}
Do not turn off ASLR, DEP, or heap protection for all applications. Use a per-program exception only when needed.
{% endhint %}

### If settings are unavailable

A work or school organization may manage Exploit Protection. Contact your administrator if the controls are locked or revert after changes.