How to View Data Execution Prevention (DEP) Status in Process Explorer

Learn how to add the DEP Status column in Process Explorer, interpret its values, and investigate DEP differences between 32-bit and 64-bit processes.

Data Execution Prevention (DEP) is a Windows memory-protection feature that helps prevent a process from executing code in memory regions intended to hold data. DEP can reduce the impact of some memory-exploitation attacks and unsafe application behavior.

Process Explorer can display the DEP state of running processes. This information is useful for inspection and diagnosis, but DEP status is only one security signal. A process with DEP enabled may still have other weaknesses, and a process without DEP is not automatically malicious.

Open the DEP Status column

Process Explorer displays process details in its main process list. The DEP field is not necessarily visible in the default column layout, so you must add it to the list.

Start Process Explorer.
Open the View menu.
Choose Select Columns to open the column-selection interface.
Find and enable DEP Status.
Apply the change and return to the main process list.

A DEP-related column should now appear in the process list. Depending on the current layout, it may be positioned far to the right. You can resize the Process Explorer window, scroll horizontally, reduce other column widths, or rearrange columns so that DEP Status is easier to review.

Clicking the DEP Status column heading can sort the process list by the displayed value. Sorting is useful when you want to group processes with similar results, although a sorted list should still be interpreted alongside the process tree and other properties.

Understand the displayed DEP values

The DEP Status column reports the DEP state that Process Explorer can establish for each process. The common values have different meanings.

Displayed value	Meaning	Typical interpretation	Recommended next step
DEP (permanent)	DEP is required for the process by the operating system.	Commonly associated with essential Windows components or processes for which execution protection is mandatory.	Record it as a strong protection setting, then review the process path, publisher, parent, and other properties.
DEP	The process has enabled or opted into DEP.	Execution protection is enabled for that process.	Consider DEP a positive mitigation signal, not a complete trust or malware determination.
Blank	The DEP Status cell is empty.	DEP is not enabled for that process according to the displayed result.	Check process architecture and Windows policy before drawing conclusions, especially for older 32-bit applications.
n/a	Process Explorer cannot establish the process's DEP state.	The result is unavailable, not an assertion that DEP is enabled or disabled.	Use appropriate administrative access when justified and investigate with other process details.

n/a is not automatically evidence of a security problem. It can reflect process type, available privileges, operating system behavior, or limits on the information that Process Explorer can query.

DEP and process architecture

A process's architecture describes whether it is built for the 32-bit or 64-bit Windows application environment. Architecture and the value shown in the DEP Status column are related, but they are not the same thing.

Windows environment	Process architecture	General DEP expectation	Important caveats
64-bit Windows	64-bit process	Execution protection is generally provided by default.	Do not use the default expectation as a substitute for checking the actual Process Explorer value and process details.
64-bit Windows	32-bit process	DEP behavior can differ between applications.	Windows-wide DEP policy, application compatibility settings, and process characteristics can affect the result.
Supported Windows configuration	32-bit process or 32-bit operating system process	DEP behavior depends on the operating system policy and the process's capabilities.	Operating system version, application design, compatibility configuration, and available query information can affect what Process Explorer displays.

Do not compare every 32-bit and 64-bit process as though identical results are expected. In particular, a blank value for a legacy 32-bit application may have a different explanation from a comparable result on a 64-bit process.

Review DEP status during an investigation

Check a particular process

Locate the target process in the main process list. Use the process name, tree position, or other identifying details.
Read its value in the DEP Status column.
Confirm the process architecture and image information.
Open the process properties when more context is needed.

For a service investigation, locate the service-hosting or system process and inspect whether it shows DEP (permanent). Use that observation as context while examining the service identity, executable path, publisher, parent process, command line, integrity level, and behavior.

Compare multiple processes

Sort by DEP Status or group your observations by process type and architecture. This can reveal differences between Windows components, third-party applications, and older 32-bit software. A difference is a reason to investigate, not proof of a fault or compromise.

For a broader assessment, combine DEP status with:

Executable path and whether the location is expected.
Publisher and digital-signature verification.
Parent process and the process tree.
Command-line arguments.
Integrity level and security context.
VirusTotal results, if available through your workflow.
Network activity, loaded modules, threads, handles, and observed behavior.

For related process details, see Process Properties, viewing integrity levels, and the Security tab.

Example: enabling DEP visibility for all processes

Open Process Explorer.
Choose View > Select Columns.
Select DEP Status.
Apply the configuration.
Find the new column in the process list, moving or resizing columns if necessary.
Review the values for the processes relevant to your investigation.

Where Process Explorer can obtain the information, each process will show a DEP state such as DEP (permanent), DEP, or a blank result. Some processes may show n/a.

Example: investigating a legacy 32-bit application

Find the application's process in Process Explorer.
Read its DEP Status value.
Confirm that the application is 32-bit rather than 64-bit.
Compare the result with the system's DEP policy and any application compatibility configuration.
Review the executable path, signature, publisher, parent process, command line, and behavior.

A blank DEP value can be relevant to compatibility or security review, but it is not by itself a diagnosis. Changing Windows DEP policy merely to make an application run can weaken protection. Any change should be evaluated against the application's necessity, its source and trustworthiness, testing results, and organizational security policy.

Scope and limitations

Process Explorer primarily reports DEP status; it is not the main interface for changing system-wide DEP policy.
The displayed result can depend on Windows version, process bitness, available privileges, process characteristics, and what Process Explorer can query.
DEP limits execution from non-executable memory regions, but it does not replace patching, application controls, endpoint protection, signature verification, or behavioral analysis.
A process that shows DEP is not necessarily trustworthy.
A process with a blank DEP value is not inherently malicious.
An n/a result means the state is unavailable to Process Explorer, not that a threat has been detected.

For a deeper view of a process's security context, compare the result with its process properties and integrity level. When you need to understand the process tree, the default Process Explorer tree view can provide useful parent-child context.

Troubleshoot missing or unexpected results

The DEP Status column is not visible

Return to View > Select Columns and verify that DEP Status is enabled.
Scroll horizontally; the column may be positioned off-screen.
Resize the Process Explorer window.
Reduce the widths of other columns or rearrange the column order.

A process displays n/a

Treat n/a as unavailable information rather than as enabled or disabled DEP. Process Explorer may be unable to retrieve the result because of process or system context, process type, privileges, or other query limitations.

When justified, run Process Explorer with appropriate administrative rights and check the process's path, signature, parent, command line, architecture, and other security properties. See Run as Administrator for the related access consideration.

A 32-bit application is blank while 64-bit processes show protection

First confirm the application's architecture. Then review the relevant Windows DEP policy and application compatibility configuration. The difference may be expected for a legacy 32-bit application. Do not change policy as a routine fix; assess both compatibility and the security consequences before making any adjustment.

DEP is being treated as a trust verdict

DEP is an exploit-mitigation signal, not a publisher check or malware verdict. Verify the executable location and signature, inspect the parent-child relationship and command line, check reputation results if available, and consider the process's observed behavior.

Key points

Add the field through View > Select Columns > DEP Status.
DEP (permanent) means DEP is required for the process.
DEP means DEP is enabled for the process.
A blank value means DEP is not enabled according to the displayed result.
n/a means Process Explorer cannot determine the state.
Architecture, Windows policy, compatibility settings, privileges, and operating system behavior affect interpretation.
Use DEP status with other Process Explorer and security evidence rather than in isolation.