Help regarding Kernal hardware enforced stack protection

Question

I enabled Kernal hardware enforced stack protection in audit mode and I can't find the logs in Event viewer.I want to see the logs so that I can see which drivers fail to load and enable it in enforcement mode One more thing if I enable in enforcement mode will my system crash?

Answer 1

Hello, When you enable it in audit mode, it doesn’t prevent or block anything, it just logs potential security issues. When you enable it in enforcement mode, it actively blocks code that looks like it’s trying to exploit the stack. The logs for this feature are located in the Windows Event Viewer under the following path: “Applications and Services Logs” -> “Microsoft” -> “Windows” -> “KernelMitigationPolicy” -> “Operational”. If you don’t see any logs, make sure that logging is enabled for KernelMitigationPolicy. Right-click on “Operational” under “KernelMitigationPolicy”, then click “Properties” and make sure “Enable logging” is checked. As for the potential system crash, it’s not likely that enabling it in enforcement mode would cause a system crash. However, it could potentially cause certain applications or drivers to stop working if they use programming techniques that look like ROP attacks. If you encounter issues, you can always switch back to audit mode or disable the feature. Best Regards, Hania Lian

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi Hania, Thanks for your reply actually yesterday I enabled it in enforcement mode but the system didn't crash the thing happened is it is now not showing in windows security application pls help