| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-220726 | CAT I | MONT-WS-92040 | Microsoft Windows 10 Security Technical ... | Data Execution Prevention (DEP) must be configured... | - | |||
Check TextVerify the DEP configuration. Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator). Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.) If the value for "nx" is not "OptOut", this is a finding. (The more restrictive configuration of "AlwaysOn" would not be a finding.) Fix TextConfigure DEP to at least OptOut. Note: Suspend BitLocker before making changes to the DEP configuration. Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator). Enter "BCDEDIT /set {current} nx OptOut". (If using PowerShell "{current}" must be enclosed in quotes.) "AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP. Opted out exceptions can be configured in the "System Properties". Open "System" in Control Panel. Select "Advanced system settings". Click "Settings" in the "Performance" section. Select the "Data Execution Prevention" tab. Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:". Finding DetailsEvaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be OPEN on 10/23/2025 ResultHash: 82C3F1B697DB48695C0120630E2A8ED6B8252DF2 ~~~~~ Data Execution Prevention is configured to 'OptIn' Windows Boot Loader ------------------- identifier {current} device partition=C: path \windows\system32\winload.efi description Windows 10 locale en-US inherit {bootloadersettings} recoverysequence {86fa2db6-faa5-11ed-8cb5-f1e0456ab8cf} displaymessageoverride Recovery recoveryenabled Yes isolatedcontext Yes allowedinmemorysettings 0x15000075 osdevice partition=C: systemroot \windows resumeobject {86fa2db4-faa5-11ed-8cb5-f1e0456ab8cf} nx OptIn bootmenupolicy Standard
Source: _Reviewed/MONT-WS-92040/Checklist/MONT-WS-92040_Win10_V3R4_20251023-142421.ckl
Scan Date: 2026-01-14T12:57:26.690022
Technology Area: Windows Operating System
|
||||||||
| V-220726 | CAT I | MONT-WS-92010 | Microsoft Windows 10 Security Technical ... | Data Execution Prevention (DEP) must be configured... | - | |||
Check TextVerify the DEP configuration. Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator). Enter "BCDEdit /enum {current}". (If using PowerShell "{current}" must be enclosed in quotes.) If the value for "nx" is not "OptOut", this is a finding. (The more restrictive configuration of "AlwaysOn" would not be a finding.) Fix TextConfigure DEP to at least OptOut. Note: Suspend BitLocker before making changes to the DEP configuration. Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator). Enter "BCDEDIT /set {current} nx OptOut". (If using PowerShell "{current}" must be enclosed in quotes.) "AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP. Opted out exceptions can be configured in the "System Properties". Open "System" in Control Panel. Select "Advanced system settings". Click "Settings" in the "Performance" section. Select the "Data Execution Prevention" tab. Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:". Finding DetailsEvaluate-STIG 1.2507.5 (Scan-Windows10_Checks) found this to be OPEN on 10/23/2025 ResultHash: 8BD6B22DCF9582BB99D89D5C035DF8B52BDC2CF8 ~~~~~ Data Execution Prevention is configured to 'OptIn' Windows Boot Loader ------------------- identifier {current} device partition=C: path \windows\system32\winload.efi description Windows 10 locale en-US inherit {bootloadersettings} recoverysequence {e1d40356-fa9e-11ed-a81c-d132769a72eb} displaymessageoverride Recovery recoveryenabled Yes isolatedcontext Yes allowedinmemorysettings 0x15000075 osdevice partition=C: systemroot \windows resumeobject {e1d40354-fa9e-11ed-a81c-d132769a72eb} nx OptIn bootmenupolicy Standard
Source: _Reviewed/MONT-WS-92010/Checklist/MONT-WS-92010_Win10_V3R4_20251023-141133.ckl
Scan Date: 2026-01-14T12:57:28.689048
Technology Area: Windows Operating System
|
||||||||