VMware ESXi and vSphere Cluster Management

How to View Data Execution Prevention (DEP) Status in Process Explorer

Learn how to enable the DEP Status column in Microsoft Process Explorer and interpret permanent, enabled, blank, and unavailable results.

What Data Execution Prevention (DEP) Does

Data Execution Prevention (DEP) is a Windows memory-protection capability. It provides execution protection by restricting code from running in memory regions intended to hold data rather than executable instructions.

This protection can reduce some exploitation attempts. For example, an attack might place malicious instructions in a data buffer and then try to execute them. DEP can block that execution when the memory region is marked as non-executable.

A process is an executing instance of an application, Windows service, or system component. DEP behavior can be examined for individual processes. Microsoft Process Explorer is a Sysinternals process-inspection utility that displays detailed information about running processes, including optional columns such as the DEP Status column.

Why Inspect DEP Status?

Viewing DEP status can help during several types of investigation:

  • Security review: Check whether important applications and services receive expected memory-execution protection.
  • Application compatibility investigation: Examine whether differences between older and newer applications may relate to architecture or mitigation behavior.
  • Process-hardening assessment: Record DEP behavior as one part of a broader review of exploit mitigations.
  • Troubleshooting: Compare processes when an application behaves differently on different Windows systems.

The value shown by Process Explorer describes the status that the tool detected for that process. It does not prove that the process is trustworthy, correctly configured in every respect, or protected against every exploitation technique.

Display the DEP Status Column

No command-line action is required. Use the Process Explorer interface:

  1. Open Process Explorer and display the main process list.
  2. Open the View menu.
  3. Select Select Columns.
  4. In the column-selection dialog, locate and enable DEP Status.
  5. Apply or confirm the selection.
  6. Return to the main process list and locate the new DEP-related column.

Process Explorer lets you adjust column placement and visibility in its interface. If the column is inconveniently placed, move it among the other columns or resize the window so that it can be seen.

The column reports the tool's detected DEP state for each listed process. It is not a replacement for examining the process properties, its architecture, Windows policy, or other mitigations.

Understanding DEP Status Values

Displayed value — Meaning — Typical interpretation — Important caution

DEP (permanent) — DEP is permanently enabled for the process. — This commonly appears for required Windows programs or services that must use DEP. — It confirms this mitigation state only; it does not establish that the component is generally secure.

DEP — The process elected to use DEP. — The application is using DEP through its process or application behavior. — The result should be considered with process architecture and Windows policy.

Blank — DEP is not enabled for that process according to the displayed field. — The process is not shown as using DEP. — A blank value is not, by itself, evidence of malicious behavior; older software and compatibility scenarios can differ.

n/a — Process Explorer cannot determine or report a definitive DEP state for the process. — The status is unavailable or not applicable to the inspection. — Treat it as unknown, not as definite proof that DEP is disabled.

Permanent DEP

A permanent DEP status indicates that the process has a DEP state that cannot be removed for its lifetime. Required Windows programs or services may display this state because they are designed to operate with the mitigation enforced.

DEP

The normal DEP value indicates that the process elected to use DEP. This is different from the permanent form because the process's protection is not described as permanently enforced in the same way.

Blank and n/a Values

A blank field means the process is not shown as having DEP enabled. An n/a value means Process Explorer could not establish a usable status or that the status does not apply in the available inspection context. Do not treat n/a as a definite disabled-security setting.

32-bit and 64-bit Behavior

Architecture is essential when interpreting the column. A 32-bit process is built for 32-bit execution; on 64-bit Windows, it can run through the operating system's compatibility support. A 64-bit process is built for native 64-bit execution.

Operating system context — Process type — Expected execution-protection behavior — Configuration dependency

64-bit Windows — 64-bit process — Execution protection is provided by default as part of the 64-bit Windows execution environment. — The displayed result can still depend on what Process Explorer can inspect and report.

64-bit Windows — 32-bit process — DEP behavior can vary according to how the application and Windows apply protection. — Windows DEP policy and application compatibility or opt-in behavior can affect the result.

32-bit Windows — 32-bit process — DEP behavior is governed by the available Windows DEP mechanisms and policy. — System configuration and application behavior remain relevant.

Do not confuse process architecture with operating-system architecture. A 32-bit application running on 64-bit Windows is still a 32-bit process. Identify the process type using an available Process Explorer indicator or by opening the process properties, then compare its DEP result with that of a native 64-bit process.

Practical Review Examples

Example 1: Review a Windows Service

  1. Enable DEP Status through View and Select Columns.
  2. Find a Windows service or core system process in the process list.
  3. Read the value in its DEP Status column.

A protected system component may display DEP (permanent). This illustrates how a required Windows program or service can appear in the same list as ordinary applications while receiving a permanently enabled DEP state.

Example 2: Compare 64-bit and 32-bit Processes

  1. Identify one native 64-bit process and one 32-bit application using a Process Explorer indicator or process properties.
  2. Compare their DEP Status values.
  3. Interpret the results using both the process architecture and the Windows operating-system architecture.

The 64-bit process receives execution protection by default on 64-bit Windows. The 32-bit application's behavior may depend more visibly on Windows DEP policy and the application's compatibility or opt-in behavior. Therefore, a difference between the two values is not necessarily an error.

Example 3: Investigate an Unavailable Result

  1. Locate a process whose field displays n/a or another indeterminate result.
  2. Review its architecture and other available process properties.
  3. Consider whether inspection permissions or the process type limit what Process Explorer can determine.
  4. Use the result as unknown until additional evidence is available.

An unavailable value is a reporting limitation or an inapplicable result, not a conclusion that DEP is disabled. When permitted by local policy, running Process Explorer with appropriate administrative rights may provide more inspection information.

Troubleshooting the DEP Column

The Column Is Not Visible

If DEP Status was selected but cannot be seen:

  • Expand the Process Explorer window or scroll horizontally. The column may be outside the currently visible area.
  • Reopen View and Select Columns and verify that DEP Status remains selected.
  • Adjust the column order or width so the field is visible.
  • Apply or confirm the selection again if the dialog has not retained it.

The Process Shows n/a

Treat n/a as unknown rather than disabled. Process Explorer may be unable to establish a definitive value because of the process type, architecture, inspection context, or available permissions. Review the process architecture and related properties, and use appropriate administrative rights when allowed.

A 32-bit Application Has an Unexpected Result

First verify that the process is actually 32-bit. Then review the system's DEP policy separately and consider the application's compatibility or opt-in behavior. Do not change system DEP settings merely to make the column display a preferred value, and do not disable DEP as a general troubleshooting step.

Limits of DEP Status

DEP is one of several Windows exploit mitigations. A fuller assessment may also consider memory-control protections, process integrity, signing, permissions, control-flow protections, application behavior, and security telemetry.

Process Explorer may not always report a definitive value. A permanent value, a normal DEP value, a blank field, or n/a should be interpreted in context. In particular, unknown status must not be converted into a claim that protection is disabled.

For a related Process Explorer reference, see viewing DEP status.